liquid_feedback_frontend: e7fc3fed1593 model/member.lua

252 selector:join("privilege", "__model_member__privilege", { "member.id = __model_member__privilege.member_id AND __model_member__privilege.voting_right AND __model_member__privilege.unit_id = ?", args.voting_right_for_unit_id })

253 end

254 if args.admin_search then

255 local search_string = "%" .. args.admin_search .. "%"

256 selector:add_where{ "member.identification ILIKE ? OR member.name ILIKE ?", search_string, search_string }

257 end

258 if args.order then

259 if args.order == "id" then

260 selector:add_order_by("id")

261 elseif args.order == "identification" then

262 selector:add_order_by("identification")

263 elseif args.order == "name" then

264 selector:add_order_by("name")

265 else

266 error("invalid order")

267 end

268 end

269 return selector

270 end

271

272 function Member:lockForReference()

273 self.get_db_conn().query("LOCK TABLE " .. self:get_qualified_table() .. " IN ROW SHARE MODE")

274 end

275

276

277 function Member:get_all_by_authority(authority)

278

279 local members = Member:new_selector()

280 :add_where{ "authority = ?", authority }

281 :add_field("authority_uid")

282 :exec()

283

284 return members

285 end

286

287 function Member.object:set_password(password)

288 trace.disable()

289

290 local hash_prefix

291 local salt_length

292

293 local function rounds()

294 return multirand.integer(

295 config.password_hash_min_rounds,

296 config.password_hash_max_rounds

297 )

298 end

299

300 if config.password_hash_algorithm == "crypt_md5" then

301 hash_prefix = "$1$"

302 salt_length = 8

303

304 elseif config.password_hash_algorithm == "crypt_sha256" then

305 hash_prefix = "$5$rounds=" .. rounds() .. "$"

306 salt_length = 16

307

308 elseif config.password_hash_algorithm == "crypt_sha512" then

309 hash_prefix = "$6$rounds=" .. rounds() .. "$"

310 salt_length = 16

311

312 else

313 error("Unknown hash algorithm selected in configuration")

314

315 end

316

317 hash_prefix = hash_prefix .. multirand.string(

318 salt_length,

319 "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz./"

320 )

321

322 local hash = extos.crypt(password, hash_prefix)

323

324 if not hash or hash:sub(1, #hash_prefix) ~= hash_prefix then

325 error("Password hashing algorithm failed")

326 end

327

328 self.password = hash

329 self.password_reset_secret = nil

330 self.password_reset_secret_expiry = nil

331 end

332

333 function Member.object:check_password(password)

334 if type(password) == "string" and type(self.password) == "string" then

335 return extos.crypt(password, self.password) == self.password

336 else

337 return false

338 end

339 end

340

341 function Member.object_get:password_hash_needs_update()

342

343 if self.password == nil then

344 return nil

345 end

346

347 local function check_rounds(rounds)

348 if rounds then

349 rounds = tonumber(rounds)

350 if

351 rounds >= config.password_hash_min_rounds and

352 rounds <= config.password_hash_max_rounds

353 then

354 return false

355 end

356 end

357 return true

358 end

359

360 if config.password_hash_algorithm == "crypt_md5" then

361

362 return self.password:sub(1,3) ~= "$1$"

363

364 elseif config.password_hash_algorithm == "crypt_sha256" then

365

366 return check_rounds(self.password:match("^%$5%$rounds=([1-9][0-9]*)%$"))

367

368 elseif config.password_hash_algorithm == "crypt_sha512" then

369

370 return check_rounds(self.password:match("^%$6%$rounds=([1-9][0-9]*)%$"))

371

372 else

373 error("Unknown hash algorithm selected in configuration")

374

375 end

376

377 end

378

379 function Member.object_get:published_contacts()

380 return Member:new_selector()

381 :join('"contact"', nil, '"contact"."other_member_id" = "member"."id"')

382 :add_where{ '"contact"."member_id" = ?', self.id }

383 :add_where("public")

384 :exec()

385 end

386

387 function Member:by_login_and_password(login, password)

388

389 local function prepare_login_selector()

390 local selector = self:new_selector()

391 selector:add_field({ "now() > COALESCE(last_delegation_check, activated) + ?::interval", config.check_delegations_interval_hard }, "needs_delegation_check_hard")

392 selector:add_where('NOT "locked"')

393 selector:optional_object_mode()

394 return selector

395 end

396

397 local function do_local_login()

398 local selector = prepare_login_selector()

399 selector:add_where{'"login" = ?', login }

400 local member = selector:exec()

401 if member and member:check_password(password) then

402 return member

403 else

404 return nil

405 end

406 end

407

408 if config.ldap.member then

409

410 -- Let's check the users credentials against the LDAP

411 local ldap_entry, ldap_err = ldap.check_credentials(login, password)

412

413 -- Is the user already registered as member?

414 local uid

415 local selector = prepare_login_selector()

416

417 -- Get login name from LDAP entry

418 if ldap_entry then

419 uid = config.ldap.member.uid_map(ldap_entry)

420 selector:add_where{'"authority" = ? AND "authority_uid" = ?', "ldap", uid }

421

422 -- or build it from the login

423 else

424 login = config.ldap.member.login_normalizer(login)

425 selector:add_where{'"authority" = ? AND "authority_uid" = ?', "ldap", login }

426 end

427

428 local member = selector:exec()

429 -- The member is already registered

430 if member then

431

432 -- The credentials entered by the user are invalid

433 if ldap_err == "invalid_credentials" then

434

435 -- Check if the user tried a cached password (which is invalid now)

436 if config.ldap.member.cache_passwords and member:check_password(password) then

437 member.password = nil

438 member:save()

439 end

440

441 -- Try a regular login

442 return do_local_login()

443

444 end

445

446 -- The credentials were accepted by the LDAP server and no error occured

447 if ldap_entry and not ldap_err then

448

449 -- Cache the password (if feature enabled)

450 if config.ldap.member.cache_passwords and not member:check_password(password) then

451 member:set_password(password)

452 end

453

454 -- update the member attributes and privileges from LDAP

455 local ldap_conn, ldap_err, err, err2 = ldap.update_member_attr(member, nil, uid)

456 if not err then

457 local err = member:try_save()

458 if err then

459 return nil, "member_save_error", err

460 end

461 local succes, err, err2 = ldap.update_member_privileges(member, ldap_entry)

462 if err then

463 return nil, "update_member_privileges_error", err, err2

464 end

465 return member

466 end

467

468 end

469

470 -- Some kind of LDAP error happened, if cached password are enabled,

471 -- check user credentials against the cache

472 if config.ldap.member.cache_passwords and member:check_password(password) then

473

474 -- return the successfully logged in member

475 return member

476

477 end

478

479 -- The member is not registered

480 elseif config.ldap.member.registration and ldap_entry and not ldap_err then

481 -- Automatic registration ("auto")

482 if config.ldap.member.registration == "auto" then

483 member = Member:new()

484 member.authority = "ldap"

485 local ldap_login

486 if config.ldap.member.cache_passwords then

487 if config.ldap.member.login_normalizer then

488 ldap_login = config.ldap.member.login_normalizer(login)

489 else

490 ldap_login = login

491 end

492 end

493 -- TODO change this when SQL layers supports hstore

494 member.authority_uid = uid

495 member.authority_login = ldap_login

496 member.activated = "now"

497 member.last_activity = "now"

498 if config.ldap.member.cache_passwords then

499 member:set_password(password)

500 end

501 local ldap_conn, ldap_err, err, err2 = ldap.update_member_attr(member, nil, uid)

502 if not err then

503 local err = member:try_save()

504 if err then

505 return nil, "member_save_error", err

506 end

507 local success, err, err2 = ldap.update_member_privileges(member, ldap_entry)

508 if err then

509 return nil, "update_member_privileges_error", err, err2

510 end

511 return member

512 end

513

514 -- No automatic registration

515 else

516 return nil, "ldap_credentials_valid_but_no_member", uid

517 end

518 end

519

520 end

521

522 return do_local_login()

523

524 end

525

526 function Member:by_login(login)

527 local selector = self:new_selector()

528 selector:add_where{'"login" = ?', login }

529 selector:optional_object_mode()

530 return selector:exec()

531 end

532

533 function Member:by_name(name)

534 local selector = self:new_selector()

535 selector:add_where{'"name" = ?', name }

536 selector:optional_object_mode()

537 return selector:exec()

538 end

539

540 function Member:get_search_selector(search_string)

541 return self:new_selector()

542 :add_field( {'"highlight"("member"."name", ?)', search_string }, "name_highlighted")

543 :add_where{ '"member"."text_search_data" @@ "text_search_query"(?)', search_string }

544 :add_where("activated NOTNULL AND active")

545 end

546

547 function Member.object:send_password_reset_mail()

548 trace.disable()

549 if not self.notify_email then

550 return false

551 end

552 self.password_reset_secret = multirand.string( 24, "23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz" )

553 local expiry = db:query("SELECT now() + '1 days'::interval as expiry", "object").expiry

554 self.password_reset_secret_expiry = expiry

555 self:save()

556 local content = slot.use_temporary(function()

557 slot.put(_"Hello " .. self.name .. ",\n\n")

558 slot.put(_"to reset your password please click on the following link:\n\n")

559 slot.put(request.get_absolute_baseurl() .. "index/reset_password.html?secret=" .. self.password_reset_secret .. "\n\n")

560 slot.put(_"If this link is not working, please open following url in your web browser:\n\n")

561 slot.put(request.get_absolute_baseurl() .. "index/reset_password.html\n\n")

562 slot.put(_"On that page please enter the reset code:\n\n")

563 slot.put(self.password_reset_secret .. "\n\n")

564 end)

565 local success = net.send_mail{

566 envelope_from = config.mail_envelope_from,

567 from = config.mail_from,

568 reply_to = config.mail_reply_to,

569 to = self.notify_email,

570 subject = config.mail_subject_prefix .. _"Password reset request",

571 content_type = "text/plain; charset=UTF-8",

572 content = content

573 }

574 return success

575 end

576

577 function Member.object:send_invitation(template_file, subject)

578 trace.disable()

579 self.invite_code = multirand.string( 24, "23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz" )

580 self:save()

581

582 local subject = subject

583 local content

584

585 if template_file then

586 local fh = io.open(template_file, "r")

587 content = fh:read("*a")

588 content = (content:gsub("#{invite_code}", self.invite_code))

589 else

590 subject = config.mail_subject_prefix .. _"Invitation to LiquidFeedback"

591 content = slot.use_temporary(function()

592 slot.put(_"Hello\n\n")

593 slot.put(_"You are invited to LiquidFeedback. To register please click the following link:\n\n")

594 slot.put(request.get_absolute_baseurl() .. "index/register.html?invite=" .. self.invite_code .. "\n\n")

595 slot.put(_"If this link is not working, please open following url in your web browser:\n\n")

596 slot.put(request.get_absolute_baseurl() .. "index/register.html\n\n")

597 slot.put(_"On that page please enter the invite key:\n\n")

598 slot.put(self.invite_code .. "\n\n")

599 end)

600 end

601

602 local success = net.send_mail{

603 envelope_from = config.mail_envelope_from,

604 from = config.mail_from,

605 reply_to = config.mail_reply_to,

606 to = self.notify_email_unconfirmed or self.notify_email,

607 subject = subject,

608 content_type = "text/plain; charset=UTF-8",

609 content = content

610 }

611 return success

612 end

613

614 function Member.object:set_notify_email(notify_email)

615 trace.disable()

616 local expiry = db:query("SELECT now() + '7 days'::interval as expiry", "object").expiry

617 self.notify_email_unconfirmed = notify_email

618 self.notify_email_secret = multirand.string( 24, "23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz" )

619 self.notify_email_secret_expiry = expiry

620 local content = slot.use_temporary(function()

621 slot.put(_"Hello " .. self.name .. ",\n\n")

622 slot.put(_"Please confirm your email address by clicking the following link:\n\n")

623 slot.put(request.get_absolute_baseurl() .. "index/confirm_notify_email.html?secret=" .. self.notify_email_secret .. "\n\n")

624 slot.put(_"If this link is not working, please open following url in your web browser:\n\n")

625 slot.put(request.get_absolute_baseurl() .. "index/confirm_notify_email.html\n\n")

626 slot.put(_"On that page please enter the confirmation code:\n\n")

627 slot.put(self.notify_email_secret .. "\n\n")

628 end)

629 local success = net.send_mail{

630 envelope_from = config.mail_envelope_from,

631 from = config.mail_from,

632 reply_to = config.mail_reply_to,

633 to = self.notify_email_unconfirmed,

634 subject = config.mail_subject_prefix .. _"Email confirmation request",

635 content_type = "text/plain; charset=UTF-8",

636 content = content

637 }

638 if success then

639 local lock_expiry = db:query("SELECT now() + '1 hour'::interval AS lock_expiry", "object").lock_expiry

640 self.notify_email_lock_expiry = lock_expiry

641 end

642 self:save()

643 return success

644 end

645

646 function Member.object:get_setting(key)

647 return Setting:by_pk(self.id, key)

648 end

649

650 function Member.object:get_setting_value(key)

651 local setting = Setting:by_pk(self.id, key)

652 if setting then

653 return setting.value

654 end

655 end

656

657 function Member.object:set_setting(key, value)

658 local setting = self:get_setting(key)

659 if not setting then

660 setting = Setting:new()

661 setting.member_id = self.id

662 setting.key = key

663 end

664 setting.value = value

665 setting:save()

666 end

667

668 function Member.object:get_setting_maps_by_key(key)

669 return SettingMap:new_selector()

670 :add_where{ "member_id = ?", self.id }

671 :add_where{ "key = ?", key }

672 :add_order_by("subkey")

673 :exec()

674 end

675

676 function Member.object:get_setting_map_by_key_and_subkey(key, subkey)

677 return SettingMap:new_selector()

678 :add_where{ "member_id = ?", self.id }

679 :add_where{ "key = ?", key }

680 :add_where{ "subkey = ?", subkey }

681 :add_order_by("subkey")

682 :optional_object_mode()

683 :exec()

684 end

685

686 function Member.object:set_setting_map(key, subkey, value)

687 setting_map = self:get_setting_map_by_key_and_subkey(key, subkey)

688 if not setting_map then

689 setting_map = SettingMap:new()

690 setting_map.member_id = self.id

691 setting_map.key = key

692 setting_map.subkey = subkey

693 end

694 setting_map.value = value

695 setting_map:save()

696 end

697

698 function Member.object_get:notify_email_locked()

699 return(

700 Member:new_selector()

701 :add_where{ "id = ?", app.session.member.id }

702 :add_where("notify_email_lock_expiry > now()")

703 :count() == 1

704 )

705 end

706

707 function Member.object_get:units_with_voting_right()

708 return(Unit:new_selector()

709 :join("privilege", nil, { "privilege.unit_id = unit.id AND privilege.member_id = ? AND privilege.voting_right", self.id })

710 :exec()

711 )

712 end

713

714 function Member.object:ui_field_text(args)

715 args = args or {}

716 if app.session:has_access("authors_pseudonymous") then

717 -- ugly workaround for getting html into a replaced string and to the user

718 ui.container{label = args.label, label_attr={class="ui_field_label"}, content = function()

719 slot.put(string.format('<span><a href="%s">%s</a></span>',

720 encode.url{

721 module = "member",

722 view = "show",

723 id = self.id,

724 },

725 encode.html(self.name)))

726 end

727 }

728 else

729 ui.field.text{ label = args.label, value = _"[not displayed public]" }

730 end

731 end

732

733 function Member.object:has_voting_right_for_unit_id(unit_id)

734 if not self.__units_with_voting_right_hash then

735 local privileges = Privilege:new_selector()

736 :add_where{ "member_id = ?", self.id }

737 :add_where("voting_right")

738 :exec()

739 self.__units_with_voting_right_hash = {}

740 for i, privilege in ipairs(privileges) do

741 self.__units_with_voting_right_hash[privilege.unit_id] = true

742 end

743 end

744 return self.__units_with_voting_right_hash[unit_id] and true or false

745 end

746

747 function Member.object:has_polling_right_for_unit_id(unit_id)

748 if not self.__units_with_polling_right_hash then

749 local privileges = Privilege:new_selector()

750 :add_where{ "member_id = ?", self.id }

751 :add_where("polling_right")

752 :exec()

753 self.__units_with_polling_right_hash = {}

754 for i, privilege in ipairs(privileges) do

755 self.__units_with_polling_right_hash[privilege.unit_id] = true

756 end

757 end

758 return self.__units_with_polling_right_hash[unit_id] and true or false

759 end

760

761 function Member.object:get_delegatee_member(unit_id, area_id, issue_id)

762 local selector = Member:new_selector()

763 if unit_id then

764 selector:join("delegation", nil, { "delegation.trustee_id = member.id AND delegation.scope = 'unit' AND delegation.unit_id = ? AND delegation.truster_id = ?", unit_id, self.id })

765 end

766 selector:optional_object_mode()

767 return selector:exec()

768 end

769

770 function Member.object:delete()

771 db:query{ "SELECT delete_member(?)", self.id }

772 end